A public company must prove quarterly patch, encryption, and access controls across 80 accounts, continuously evaluate and collect control evidence mapped to a framework, and share compliance reports with auditors without giving console access. Manual screenshots are failing. Which approach automates evidence collection and organization for compliance reviews?
Select an answer to reveal the explanation.
Short Explanation
You can replace failing screenshots with continuous, organized evidence collection. Conformance packs apply framework-aligned AWS Config rules across all 80 accounts, and exported reports let auditors review the results without console access.
Full Explanation
AWS Config organization conformance packs deploy framework-aligned managed rules—for example, checks for patch compliance, encryption, and access keys—across every account. Config continuously evaluates resources and retains configuration and compliance history as evidence; an aggregator rolls up results across accounts, and compliance results and snapshots can be exported to S3 so auditors can review reports without console access. AWS Artifact provides on-demand access to AWS’s own compliance reports and agreements, not continuous evidence about your resources or framework mapping. Individual AWS Config rules can evaluate configuration, but ad hoc rules without framework-aligned packs or aggregation do not provide consistent multi-account deployment or organized, auditor-ready reporting. AWS CloudTrail Lake supports SQL analysis of activity logs, but it does not map evidence to frameworks or delegate framework-based auditor reports; it is also closed to new customers. For the exam, distinguish AWS’s reports in Artifact from evidence about your own resources in Config conformance packs. In practice, enable the organization aggregator and start with the sample pack closest to your framework.